Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects the second-stage payload of the ChainDrop/Mini Shai-Hulud npm supply chain worm, specifically targeting GitHub Actions runner environments. The rule identifies obfuscated Bun-bundled CommonJS credential-stealing scripts (math_init.js) designed to harvest secrets from the Runner.Worker process memory and communicate with C2 infrastructure via EtherHiding Ethereum contract interaction.
Detects the second-stage payload of the ChainDrop/Mini Shai-Hulud npm supply chain worm, specifically targeting GitHub Actions runner environments. The rule identifies obfuscated Bun-bundled CommonJS credential-stealing scripts (math_init.js) designed to harvest secrets from the Runner.Worker process memory and communicate with C2 infrastructure via EtherHiding Ethereum contract interaction.
This rule monitors for known file hashes and network indicators associated with Bindcloak malware. It alerts on endpoint file execution events matching specific SHA256/MD5/SHA1 hashes and network connection events to suspicious domains or a specific malicious IP address.
Detects dual remote-access activity initiated by PowerShell. The rule tracks two behaviors: the installation of an UltraVNC server listener on ports 5800/5900, and PowerShell-spawned executables dropped into common user-writable directories (Temp, AppData, etc.) establishing network connections to known Larva-24009 C2 infrastructure.
This rule detects network connections to known malicious IP addresses, domains, and URLs, as well as the execution or presence of files with known malicious SHA256 hashes. It correlates network and file events to identify potential compromise indicators.
Summarizes Zscaler NSSWeblog transactions where DeviceAction was Allowed but Zscaler still recorded a malware/threat verdict (ClickFix, MalURL, Trojan.Gen families), broken down by user, threat name, and malware category for triage.
Detects a downloaded archive that does not begin with the standard ZIP local file header 'PK' magic bytes yet still contains valid ZIP central directory or end-of-central-directory signatures alongside Edgecution-specific package content (extension/background.js path, embedded python-3.13.3-embed-amd64-with-pip.zip runtime, or the com.ppeasqabfpxcz.api native messaging host id), consistent with the Edgecution/UNC6692 technique of stripping PK bytes from archives (e.g. patch3265343.a) before an AutoHotkey stager reconstructs bsvqikydknqqk.zip by prepending 0x50 0x4B at runtime
Matches known Larva-24009 (HeptaX) malicious file hashes
SNOWBELT time-based DGA S3 bucket manifest retrieval
Summarizes Zscaler NSSWeblog transactions where DeviceAction was Allowed but Zscaler still recorded a malware/threat verdict (ClickFix, MalURL, Trojan.Gen families), broken down by user, threat name, and malware category for triage.
Detects CornFlake RAT Go stub/standalone build artifacts: requires the Go-compiled size/entropy heuristic to co-occur with a localized high-entropy PE section consistent with an XOR-encrypted embedded C2 config, and with absence of the standard main.main symbol consistent with garble-style symbol obfuscation, rather than matching on size/entropy alone
Detects Edgecution/SNOW malware suite components across the kill chain via known SHA256 file hashes (phishing HTML, AutoHotkey stager, Edgecution ZIP archive, extension background.js, Python native host backdoor) and combinations of embedded code/path strings associated with SNOWGLAZE/SNOWBASIN; requires multiple distinctive strings together to reduce false positives
Detects execution of the Edgecution malware suite native messaging host (native_host.py), which fingerprints the host system by reading environment variables (USERNAME, COMPUTERNAME, etc.). The rule correlates this behavior with a specific, suspicious process lineage originating from Microsoft Edge (msedge.exe -> native host -> python.exe).
Detects the execution of MCI commands via winmm.dll to play 'fsociety_sound.mp3', a technique used by TOKYOCORE ransomware to perform audio theatrics during its lockscreen phase.
UNC6692 Edgecution phishing/payload page hosted on AWS S3 static website hosting (patch.html/.a payload)
Detects SourTrade browser-assembled malicious executables requiring the combination of a PE section named .bun, embedded JavaScriptCore bytecode reference (app.js), and anomalous high-entropy padding, distinguishing malicious assembled payloads from legitimate Bun single-file executables that contain a .bun section alone
This rule detects potential command-and-control (C2) activity related to the NodeSnake RAT. It specifically identifies cleartext HTTP requests attempting to initiate a WebSocket upgrade (using the Sec-WebSocket-Key header) while the target host is specified as an IP address literal rather than a domain name, which is a common indicator of hardcoded or non-DNS-dependent C2 infrastructure.
This rule monitors for the execution or interaction with macOS native security components, specifically XProtect, XProtectRemediator, and YARA-based detection processes. It flags events related to these tools as potential security telemetry, scanning activities, or remediation actions.
This rule identifies known malicious components associated with TriBack Loader by monitoring for exact cryptographic MD5 hash matches of three specific DLL files: hostfxr.dll, avk.dll, and MpClient.dll. By using exact hash matching, the rule minimizes the risk of false positives that might arise from filename-based detection of legitimate system binaries.
Detects SleeperGem RubyGems supply chain artifacts: hardcoded Forgejo C2 reference in gem Ruby source, the git-credential-manager binary dropped under the hidden gcm path, and supporting deploy.sh/persistence indicators (ping6 backdoor, systemd/cron service under the git-credential-manager name)
This rule monitors Palo Alto Networks firewalls for files identified as malicious by the WildFire or ML-based threat detection engines. It filters out known allowed file hashes and aggregates events to provide a high-confidence alert. The rule categorizes threats based on the verdict ('malicious', 'malware', 'phishing', 'suspicious', 'c2') and distinguishes whether the threat was blocked or delivered to the network, providing context for incident response.
Page 62 of 232